Session Hijacking Why web security depends on communications security and how TLS everywhere is the only solution. Scott Helme - 6th Aug 2013 - scotthel.me

Introduction Transport Layer Security (TLS), and its predecessor Secure Sockets Layer (SSL) as many will know it, are cryptographic protocols used to offer communication security over the Internet. Hypertext Transfer Protocol Secure (HTTPS) is not actually a protocol in and of itself. It is actually the use of Hypertext Transfer Protocol (HTTP) on top of TLS which affords the standard HTTP communications protocol the protection of TLS. Session Hijacking (a.k.a. Session Sidejacking) is a form of Man In The Middle (MITM) attack in which a malicious attacker has access to the transport layer and can eavesdrop on communications. When communications are not protected they can steal the unique session ID and impersonate the victim on the target site. This grants the attacker access to your account and data.

Why do we use TLS? To verify the website you are connecting to is the genuine website. To ensure the privacy of your data during transit. To ensure the integrity of your data during transit.

Example When first visiting the site you are using HTTP. The sensitive login form is loaded over HTTPS.

Example The login form is loaded over HTTPS to ensure the integrity of the form in transit. This prevents a man in the middle from altering the form. The login form then submits the user credentials over HTTPS to ensure the same man in the middles can’t read the credentials in transit. The TLS certificate also allows us to be confident that the website we are viewing is actually the website it claims to be. The fact that TLS has been utilised is an acknowledgement that a man in the middle could access or modify data during transit.

Example The problem arises when the site reverts back to loading content over HTTP once the user has authenticated. The assumption is that now the sensitive user credentials have been exchanged we no longer need to protect the traffic during transit.

Why does this matter? HTTP and HTTPS are stateless protocols. This means each time you request some new content from the site (a page, image or any form of media) the server does not know who you are, it does not remember you. To combat this, when you first visit a site you are issued a unique session ID. With each request you send to the site, your session ID is sent with it. This is how the site identifies you. Once you have logged in on the secure login page, your session ID lets the server remember you have logged in without having to keep sending your username and password to prove your identity. Once the website reverts back to HTTP your session ID still has to be sent but is no longer afforded the protection offered by TLS.

Summary TLS (HTTPS) was used to protect your username and password during the logon process to prevent a man in the middle viewing the content of your traffic and stealing your credentials. The session ID is not being afforded the same level of protection but an attacker could use it to impersonate you on the target website. All they need to do is substitute their own session ID with your session ID and the server will believe the attacker is you. Once your session ID has been obtained this is a trivial task. The attacker is then logged in to your account and can do anything that you could do.

Conclusion Whilst obtaining your session ID does not generally reveal your username or password the attacker can still access your account as if they were logged in as you. This attack is possible because TLS is not used across the entire site. We accept an attacker could access our traffic, which is why we need TLS in the first instance. Sites regularly fail to protect the session ID which can be considered an equivalent to your user credentials on the target website. Forcing all traffic to the site over HTTPS would completely mitigate a session hijacking attack.

Thanks You can find more info covering this and other forms of attack on my blog: http://scotthel.me Please feel free to share this information generously but do provide attribution back to my site. This work is licensed under the Creative Commons Attribution 3.0 Unported License. To view a copy of this license, visit http://creativecommons.org/licenses/by/3.0/